Bug 1795964

Do you have the policy?

Working on it.

Assigning to Jindrich for any packaging or BZ needs.  I think this was rolled up in prior releases.

The kubevirt virt-launcher cil policy seems to install just fine on recent versions of OCP/RHCOS.

I just tested this, here are some (redacted) logs:

$ openshift-install version | head -1
openshift-install 4.4.6
$ openshift-install --dir ocp create cluster
[...]
$ export KUBECONFIG=`pwd`/ocp/auth/kubeconfig
$ oc get nodes  # Pick a worker
$ oc debug node/<worker>
sh-4.2# chroot /host
sh-4.4# cat /etc/redhat-release 
Red Hat Enterprise Linux CoreOS release 4.4
sh-4.4# runcon -t container_t /bin/echo test
test
sh-4.4# runcon -t virt_launcher.process /bin/echo test
runcon: invalid context: 'system_u:system_r:virt_launcher.process:s0': Invalid argument
sh-4.4# exit
sh-4.2# exit
$ export KUBEVIRT_VERSION=v0.29.2
$ kubectl create -f https://github.com/kubevirt/kubevirt/releases/download/${KUBEVIRT_VERSION}/kubevirt-operator.yaml
$ kubectl create -f https://github.com/kubevirt/kubevirt/releases/download/${KUBEVIRT_VERSION}/kubevirt-cr.yaml
$ sleep 2m
$ oc debug node/<worker>
sh-4.2# chroot /host
sh-4.4# runcon -t virt_launcher.process /bin/echo test
test

(In reply to Jed Lejosne from comment #9)
> The kubevirt virt-launcher cil policy seems to install just fine on recent
> versions of OCP/RHCOS.

Jed, what are you saying? That we no longer need virt_launcher*_t intriduced here? Please be explicit regarding an action we should take.

(In reply to Dan Kenigsberg from comment #12)
> (In reply to Jed Lejosne from comment #9)
> > The kubevirt virt-launcher cil policy seems to install just fine on recent
> > versions of OCP/RHCOS.
> 
> Jed, what are you saying? That we no longer need virt_launcher*_t intriduced
> here? Please be explicit regarding an action we should take.

Yes, I am implying that virt_launcher*_t doesn't need to be added to the main policy anymore, since .cil modules seem to install just fine on RHCOS.
However, it is possible I missed something here, which is why I pasted some shell logs to make sure we're all talking about the same thing.
If I'm correct, then no action is needed on this ticket anymore.

Don't we need to revert the change introduced here? (for cleanliness sake)

(In reply to Dan Kenigsberg from comment #14)
> Don't we need to revert the change introduced here? (for cleanliness sake)

I wonder which changes have been introduced here?
https://github.com/containers/container-selinux/pull/87 has never been merged. Dan Walsh, just pointed out that there is a container_kvm_t policy, however, it is not a good fit for us.
Hence, I don't see which changes do we need to revert.
Does anyone know of the existence of virt_launcher*_t policy in conatiner-selinux?

I checked RHCOS 4.4, and its SELinux policy doesn't have a virt_launcher_t type.
From a toolbox shell:
```
# sesearch -s virt_launcher_t -A
virt_launcher_t is not a valid type attribute
```

(In reply to Jed Lejosne from comment #16)
> I checked RHCOS 4.4, and its SELinux policy doesn't have a virt_launcher_t
> type.
> From a toolbox shell:
> ```
> # sesearch -s virt_launcher_t -A
> virt_launcher_t is not a valid type attribute
> ```

Thank you, Jed.
I think we are safe and there is nothing to revert.

I agree. No code has been merged. This bug is falsely part of an errata.

Jindrich, can you please drop this bug from the errata and close it?

Closing based on comment #18.